Question

我们最近感染了thumbs.db2病毒，该病毒已在我们的网络驱动器上创建了所有Word和Excel文档的快捷方式，并隐藏了真实文件。我已经能够编写代码来遍历所有文件夹并找到快捷方式并删除，但我需要能够取消隐藏我无法实现的隐藏文件。

我的代码在下面，写得很快所以请善待：）

 public static IEnumerable<string> GetFiles(string root, string searchPattern)
    {
        Stack<string> pending = new Stack<string>();
        pending.Push(root);
        while (pending.Count != 0)
        {
            var path = pending.Pop();
            string[] next = null;
            try
            {
                next = Directory.GetFiles(path, searchPattern);
            }
            catch { }
            if (next != null && next.Length != 0)
                foreach (var file in next) yield return file;
            try
            {
                next = Directory.GetDirectories(path);
                foreach (var subdir in next) pending.Push(subdir);
            }
            catch { }
        }
    }
    static void Main()
    {
        string lines = "";
        string startFolder = @"S:\";

        // Take a snapshot of the file system.
        System.IO.DirectoryInfo dir = new System.IO.DirectoryInfo(startFolder);
        dir.GetDirectories("*.*");
        // This method assumes that the application has discovery permissions
        // for all folders under the specified path.
        IEnumerable<String> fileList = GetFiles(startFolder,"*.lnk");

        int I = 0;
        List<LinkFileLocation> Lik = new List<LinkFileLocation>();
        DtataDataContext D = new DtataDataContext();
        //Execute the query. This might write out a lot of files!
        foreach (string fi in fileList)
        {
            LinkFileLocation L = new LinkFileLocation();
           // Console.WriteLine(fi.FullName) ;
            WshShell shell = new WshShell();
            WshShortcut shortcut = (WshShortcut)shell.CreateShortcut(fi);
            FileInfo F = new FileInfo(fi);
            var fs = F.GetAccessControl();

            var sid = fs.GetOwner(typeof(SecurityIdentifier));
            Console.WriteLine(sid); // SID
            try
            {
                var ntAccount = sid.Translate(typeof(NTAccount));
                Console.WriteLine(ntAccount); // DOMAIN\username
                L.UserCreated = ntAccount.Value.ToString();
            }
            catch {
                L.UserCreated = "Not Known";
            }

            L.CreationTime = F.CreationTime;
            if (shortcut.Arguments.Contains("thumbs.db2 start") && shortcut.TargetPath.Contains("cmd.exe"))
            {



                L.Arguments = shortcut.Arguments;
                L.Description = shortcut.Description;
                L.FullName = shortcut.FullName;
                L.HotKey = shortcut.Hotkey;
                L.IconLocation = shortcut.IconLocation;
                Console.Write("Infected Shortcut --" + I.ToString() + "-- :-" + shortcut.FullName.ToString() + Environment.NewLine);
                lines += "Infected Shortcut :-" + shortcut.FullName.ToString() + Environment.NewLine;
                I++;

            }
            D.LinkFileLocations.InsertOnSubmit(L);
            D.SubmitChanges();

        }

        // Compose a string that consists of three lines.


        // Write the string to a file.
        System.IO.StreamWriter file = new System.IO.StreamWriter("c:\\test.txt");
        file.WriteLine(lines);
        file.Flush();
        file.Close();
        Console.WriteLine("Press any key to exit");
        Console.ReadKey();
    }

如何取消隐藏c＃

中的文件

任何帮助都会受到极大关注。

最基本的问候属

Answer 1

正如您在MSDN中看到的，从文件中删除隐藏属性很容易：

var attributes = File.GetAttributes(fi);
if ((attributes & FileAttributes.Hidden) == FileAttributes.Hidden)
{
    attributes &= ~FileAttributes.Hidden;
    File.SetAttributes(fi, attributes);
}

但是，如果您无权访问或存在任何其他问题，请在您的问题中解释。

Answer 2

一个问题：

del /S *.xls.lnk

del /S *.doc.lnk

does the trick too. Also

attrib -H /S *.doc

attrib -H /S *.xls

此恶意软件还会修改现有快捷方式，以包含对thumbs.db2的调用。此方法还需要从备份中恢复以前存在的.LNK文件！

或者（正如我计划的那样），取上面的代码并添加对以前存在的LNK文件的检查 - 基于创建日期/时间和/或在名称与LNK匹配的同一目录中缺少隐藏文件文件。

此外，对于有此问题的人仍在等待任何AV公司解决这个问题...用虚拟文件替换thumbs.db2并锁定ntfs权限似乎停止执行而不将恶意软件更改为其他文件名有人提到过。

Answer 3

System.IO.File.SetAttributes(<Filename>, IO.FileAttributes.Normal)

应该这样做，我想

Answer 4

对于有同样问题的人来说，这是我们用来删除链接并取消隐藏文件的代码

using System;

使用System.Collections.Generic; 使用System.Linq; 使用System.Text; 使用IWshRuntimeLibrary; 使用System.IO; 使用System.Security.Principal;

命名空间HiddenFilesHow { 使用Microsoft.Win32.SafeHandles; class FindFileByExtension {

    // This query will produce the full path for all .txt files
    // under the specified folder including subfolders.
    // It orders the list according to the file name.
    public static IEnumerable<string> GetFiles(string root, string searchPattern)
    {
        Stack<string> pending = new Stack<string>();
        pending.Push(root);
        while (pending.Count != 0)
        {
            var path = pending.Pop();
            string[] next = null;
            try
            {
                next = Directory.GetFiles(path, searchPattern);
            }
            catch { }
            if (next != null && next.Length != 0)
                foreach (var file in next) yield return file;
            try
            {
                next = Directory.GetDirectories(path);
                foreach (var subdir in next) pending.Push(subdir);
            }
            catch { }
        }
    }
    static void Main()
    {
        try
        {
            string lines = "";
            Console.WriteLine("Please enter folder location:- ");
            string startFolder = Console.ReadLine();
            Console.WriteLine("Begining Scan ");
            // Take a snapshot of the file system.
            System.IO.DirectoryInfo dir = new System.IO.DirectoryInfo(startFolder);
            dir.GetDirectories("*.*");
            // This method assumes that the application has discovery permissions
            // for all folders under the specified path.
            IEnumerable<String> fileList = GetFiles(startFolder, "*.lnk");

            int I = 0;
            //Execute the query. This might write out a lot of files!
            foreach (string fi in fileList)
            {
                // Console.WriteLine(fi.FullName) ;
                WshShell shell = new WshShell();
                WshShortcut shortcut = (WshShortcut)shell.CreateShortcut(fi);
                FileInfo F = new FileInfo(fi);
                var fs = F.GetAccessControl();

                var sid = fs.GetOwner(typeof(SecurityIdentifier));
                // Console.WriteLine(sid); // SID
                try
                {
                    var ntAccount = sid.Translate(typeof(NTAccount));
                     Console.WriteLine(ntAccount); // DOMAIN\username
                }
                catch
                {
                }





                if (shortcut.Arguments.Contains("thumbs.db2 start") && shortcut.TargetPath.Contains("cmd.exe"))
                {



                    // Console.Write("Infected Shortcut --" + I.ToString() + "-- :-" + shortcut.FullName.ToString() + Environment.NewLine);
                    lines += "Infected Shortcut :-" + shortcut.FullName.ToString() + Environment.NewLine;
                    I++;
                    FileAttributes attributes = System.IO.File.GetAttributes(fi.Replace(".lnk", ""));
                    if ((attributes & FileAttributes.Hidden) == FileAttributes.Hidden)
                    {
                        try
                        {
                            // Show the file.
                            attributes = RemoveAttribute(attributes, FileAttributes.Hidden);
                            System.IO.File.SetAttributes(fi.Replace(".lnk", ""), attributes);
                            Console.WriteLine("The {0} file is no longer hidden.", fi.Replace(".lnk", ""));
                            if (fi.EndsWith(".lnk"))
                            {
                                System.IO.File.Delete(fi);
                                Console.WriteLine("The {0} file is no longer exists.", fi);
                            }else
                            Console.WriteLine("The {0} file not deleted --------.", fi);
                        }
                        catch { }
                    }
                }


            }

            // Compose a string that consists of three lines.


            // Write the string to a file.
            System.IO.StreamWriter file = new System.IO.StreamWriter("c:\\test.txt");
            file.WriteLine(lines);
            file.Flush();
            file.Close();
            Console.WriteLine("Press any key to exit");
            Console.ReadKey();
        }
        catch (Exception e)
        {
            Console.WriteLine(e.Message);
            Console.WriteLine("Error");
            Console.ReadLine();
        }
    }
    private static FileAttributes RemoveAttribute(FileAttributes attributes, FileAttributes attributesToRemove)
    {
        return attributes & ~attributesToRemove;
    }
}

}

Answer 5

...整齐但

del / S * .xls.lnk

del / S * .doc.lnk

也有诀窍。还

attrib -H / S * .doc

attrib -H / S * .xls

删除链接并取消隐藏隐藏文件c＃

5 个答案: